I also would be fine as long as "or worse fines will follow" is true. I would consider as desirable that egregious, systematic and catastrophic security failur

I also would be fine as long as "or worse fines will follow" is true. I would consider as desirable that egregious, systematic and catastrophic security failures would be resulting in fines and penalties large enough to bankrupt companies[0]. But starting from that is rather not a good idea, I agree that some warning is a good idea. [0] for example 2000$ for every single leaked address that they deliberately collected (if company is scared: then they should not ask user for address data! Companies very rarely actually need it, and they still ask.).